Pihole + Unbound not working as it should

[alxnt]

Expected Behaviour:

I got a raspberry pi zero to install pihole and unbound on it which were installed on a ubuntu server vm until now with zero issues.
When I installed both pihole and unbound I restored the configuration of my vm setup from teleporter and did some tests.
Neither pihole nor unbound seem to work as they should.
On Ad Blocker Test - d3ward I get 75-80%. Same behavior for https://canyoublockit.com/.
I used to get 100% when it was installed on the vm.

Also unbound is not working well, too.
It keeps using cloudflare as dns. It was working fine when it was installed on vm and it showed my public ip address as my dns server.

For example:

<<>> DiG 9.16.22-Raspbian <<>> cnn.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15428
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;cnn.com.                       IN      A

;; ANSWER SECTION:
cnn.com.                48      IN      A       151.101.1.67
cnn.com.                48      IN      A       151.101.65.67
cnn.com.                48      IN      A       151.101.129.67
cnn.com.                48      IN      A       151.101.193.67

;; Query time: 29 msec
;; *SERVER: 1.1.1.1#53(1.1.1.1)*
;; WHEN: Wed Dec 01 16:54:01 EET 2021
;; MSG SIZE  rcvd: 100

I have uninstalled and re-installed it with no success.

Please help!

[Bucking_Horn]

Please upload a debug log and post just the token URL that is generated after the log is uploaded by running the following command from the Pi-hole host terminal:

pihole -d

or do it through the Web interface:

Tools > Generate Debug Log

[jfb]

@alxnt

Also unbound is not working well, too.
It keeps using cloudflare as dns.

What is showing that unbound is using Cloudflare as DNS?

The example dig that you posted shows that the Pi-hole host OS is using Cloudflare, but the nameserver used by the host OS is not the same as the upstream DNS server used by Pi-hole or the configuration of unbound.

[alxnt]

https://tricorder.pi-hole.net/gITNiRfK/

[jfb]

Your debug log is normal. Pi-hole is sending DNS queries to unbound as you have specified.

Let's see how unbound is configured. Please post the output of this command from the Pi terminal:

sudo grep -v '#\|^$' -R /etc/unbound/unbound.conf*

[alxnt]

@jfb I understand what you say.
What seems weird to me is that when pihole was installed on the vm and I run https://www.whatsmydnsserver.com/ it showed that my dns server was my public ip.
Now that I have installed it on raspberry it shows cloudflare.

[alxnt]

@jfb

sudo grep -v '#|^$' -R /etc/unbound/unbound.conf*

 sudo grep -v '#\|^$' -R /etc/unbound/unbound.conf*
/etc/unbound/unbound.conf:include-toplevel: "/etc/unbound/unbound.conf.d/*.conf"
/etc/unbound/unbound.conf.d/pi-hole.conf:server:
/etc/unbound/unbound.conf.d/pi-hole.conf:    verbosity: 0
/etc/unbound/unbound.conf.d/pi-hole.conf:    interface: 127.0.0.1
/etc/unbound/unbound.conf.d/pi-hole.conf:    port: 5335
/etc/unbound/unbound.conf.d/pi-hole.conf:    do-ip4: yes
/etc/unbound/unbound.conf.d/pi-hole.conf:    do-udp: yes
/etc/unbound/unbound.conf.d/pi-hole.conf:    do-tcp: yes
/etc/unbound/unbound.conf.d/pi-hole.conf:    do-ip6: no
/etc/unbound/unbound.conf.d/pi-hole.conf:    prefer-ip6: no
/etc/unbound/unbound.conf.d/pi-hole.conf:    harden-glue: yes
/etc/unbound/unbound.conf.d/pi-hole.conf:    harden-dnssec-stripped: yes
/etc/unbound/unbound.conf.d/pi-hole.conf:    use-caps-for-id: no
/etc/unbound/unbound.conf.d/pi-hole.conf:    edns-buffer-size: 1472
/etc/unbound/unbound.conf.d/pi-hole.conf:    prefetch: yes
/etc/unbound/unbound.conf.d/pi-hole.conf:    num-threads: 1
/etc/unbound/unbound.conf.d/pi-hole.conf:    so-rcvbuf: 1m
/etc/unbound/unbound.conf.d/pi-hole.conf:    private-address: 192.168.0.0/16
/etc/unbound/unbound.conf.d/pi-hole.conf:    private-address: 169.254.0.0/16
/etc/unbound/unbound.conf.d/pi-hole.conf:    private-address: 172.16.0.0/12
/etc/unbound/unbound.conf.d/pi-hole.conf:    private-address: 10.0.0.0/8
/etc/unbound/unbound.conf.d/pi-hole.conf:    private-address: fd00::/8
/etc/unbound/unbound.conf.d/pi-hole.conf:    private-address: fe80::/10
/etc/unbound/unbound.conf.d/root-auto-trust-anchor-file.conf:server:
/etc/unbound/unbound.conf.d/root-auto-trust-anchor-file.conf:    auto-trust-anchor-file: "/var/lib/unbound/root.key"
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:forward-zone:
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:  name: "."
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:  forward-addr: 1.1.1.1
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:  forward-addr: 1.0.0.1

[jfb]

@alxnt

Now that I have installed it on raspberry it shows cloudflare.

From what platform are you opening that URL to check your DNS server? The Pi or another device on the network?

[alxnt]

@jfb From windows/linux desktop
windows vm and android mobile.

[jfb]

Your last output shows this configuration file that is causing unbound to be a forwarding resolver, not a recursive resolver:

/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:forward-zone:
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:  name: "."
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:  forward-addr: 1.1.1.1
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:  forward-addr: 1.0.0.1

This is caused by resolvconf running in the current (October 2021) Raspberry Pi release of the native Bullseye image.

If you check in file /etc/resolvconf.conf, you will see this as the last line.

# Configuration for resolvconf(8)
# See resolvconf.conf(5) for details

resolv_conf=/etc/resolv.conf
# If you run a local name server, you should uncomment the below line and
# configure your subscribers configuration files below.
#name_servers=127.0.0.1


# Mirror the Debian package defaults for the below resolvers
# so that resolvconf integrates seemlessly.
dnsmasq_resolv=/var/run/dnsmasq/resolv.conf
pdnsd_conf=/etc/pdnsd.conf
unbound_conf=/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf

Comment out that last line.

Then, remove the configuration file that Raspbian put into your unbound configuration folder:

sudo rm /etc/unbound/unbound.conf.d/resolvconf_resolvers.conf

Then restart unbound

sudo service unbound restart

and unbound will be back in recursive mode.

[alxnt]

@jfb You are a SUPERHERO!
Thank you my friend